![](/screenshots/02da2cad-b84f-4dbc-8c88-38a9c346dd53.png)
libertador.mx
Open in
urlscan Pro
170.10.164.71
Malicious Activity!
Public Scan
Effective URL: https://libertador.mx/wp-home.php
Submission: On January 12 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 3rd 2021. Valid for: 3 months.
This is the only time libertador.mx was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
ASN14061 (DIGITALOCEAN-ASN, US)
www.spfi.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN32934 (FACEBOOK, US)
connect.facebook.net |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-66.deploy.static.akamaitechnologies.com
img.en25.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-89-22-29.deploy.static.akamaitechnologies.com
img04.en25.com |
ASN32934 (FACEBOOK, US)
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
vidyard.com
1 redirects
play.vidyard.com — Cisco Umbrella Rank: 10584 assets.vidyard.com — Cisco Umbrella Rank: 21803 Failed raw.vidyard.com cdn.vidyard.com |
446 KB |
15 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1252 |
289 KB |
6 |
typekit.net
use.typekit.net — Cisco Umbrella Rank: 455 p.typekit.net — Cisco Umbrella Rank: 565 |
141 KB |
6 |
spfi.com
www.spfi.com |
308 KB |
5 |
libertador.mx
2 redirects
libertador.mx |
74 KB |
3 |
eloqua.com
1 redirects
s204200226.t.eloqua.com |
2 KB |
3 |
live.com
login.live.com — Cisco Umbrella Rank: 54 |
2 KB |
2 |
facebook.com
www.facebook.com — Cisco Umbrella Rank: 88 |
425 B |
2 |
en25.com
img.en25.com — Cisco Umbrella Rank: 5868 img04.en25.com — Cisco Umbrella Rank: 13493 |
9 KB |
2 |
facebook.net
connect.facebook.net — Cisco Umbrella Rank: 126 |
113 KB |
1 |
advisorgroup.com
bdcms.advisorgroup.com |
|
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 33 |
20 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 37 |
868 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62 |
40 KB |
1 |
danslemonde.ru
1 redirects
danslemonde.ru |
150 B |
1 |
web.app
msonline-auth01.web.app |
9 KB |
1 |
atdmt.com
1 redirects
ad.atdmt.com — Cisco Umbrella Rank: 2070 |
953 B |
85 | 17 |
Domain | Requested by | |
---|---|---|
15 | aadcdn.msftauth.net |
msonline-auth01.web.app
libertador.mx |
10 | assets.vidyard.com |
play.vidyard.com
assets.vidyard.com |
7 | play.vidyard.com |
1 redirects
www.spfi.com
play.vidyard.com assets.vidyard.com |
6 | www.spfi.com |
libertador.mx
www.spfi.com |
5 | use.typekit.net |
www.spfi.com
use.typekit.net |
5 | libertador.mx |
2 redirects
msonline-auth01.web.app
libertador.mx |
4 | raw.vidyard.com |
assets.vidyard.com
|
3 | s204200226.t.eloqua.com |
1 redirects
www.spfi.com
|
3 | login.live.com |
msonline-auth01.web.app
libertador.mx |
2 | cdn.vidyard.com |
www.spfi.com
assets.vidyard.com |
2 | www.facebook.com |
www.spfi.com
|
2 | connect.facebook.net |
msonline-auth01.web.app
connect.facebook.net |
1 | img04.en25.com |
www.spfi.com
|
1 | img.en25.com |
play.vidyard.com
|
1 | bdcms.advisorgroup.com |
www.spfi.com
|
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | p.typekit.net |
use.typekit.net
|
1 | fonts.googleapis.com |
www.spfi.com
|
1 | www.googletagmanager.com |
www.spfi.com
|
1 | danslemonde.ru | 1 redirects |
1 | msonline-auth01.web.app | |
1 | ad.atdmt.com | 1 redirects |
85 | 22 |
This site contains links to these domains. Also see Links.
Domain |
---|
passwordreset.spfi.com |
www.spfi.com |
privacy.spfi.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
web.app GTS CA 1D4 |
2021-12-02 - 2022-03-02 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2021-05-13 - 2022-05-13 |
a year | crt.sh |
graph.windows.net DigiCert SHA2 Secure Server CA |
2021-11-25 - 2022-11-25 |
a year | crt.sh |
libertador.mx cPanel, Inc. Certification Authority |
2021-11-03 - 2022-02-01 |
3 months | crt.sh |
joinsagepoint.com R3 |
2021-12-28 - 2022-03-28 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
use.typekit.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-08-16 - 2022-08-16 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.vidyard.com GlobalSign Atlas R3 DV TLS CA H2 2021 |
2021-12-24 - 2023-01-25 |
a year | crt.sh |
*.typekit.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-05 - 2022-12-06 |
a year | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-10-21 - 2022-01-19 |
3 months | crt.sh |
bdcms.advisorgroup.com Trusted Secure Certificate Authority 5 |
2020-07-27 - 2022-07-27 |
2 years | crt.sh |
*.en25.com DigiCert SHA2 Secure Server CA |
2021-09-14 - 2022-09-14 |
a year | crt.sh |
*.t.eloqua.com DigiCert SHA2 Secure Server CA |
2020-03-09 - 2022-04-08 |
2 years | crt.sh |
This page contains 7 frames:
Primary Page:
https://libertador.mx/wp-home.php
Frame ID: A1ADA39959F168DF137E3A9D875784AE
Requests: 21 HTTP requests in this frame
Frame:
https://login.live.com/Me.htm?v=3
Frame ID: 2439CADB56ABCF7398662B299F2EC1E5
Requests: 1 HTTP requests in this frame
Frame:
https://www.spfi.com/
Frame ID: 9C8BCA27B57B41E4AD0DA0C17D4A0DEB
Requests: 38 HTTP requests in this frame
Frame:
https://play.vidyard.com/dg1258gnEQP1zD8h8XhAgo?v=3.1.1&type=inline&referring_url=https%253A%252F%252Flibertador.mx%252F&
Frame ID: 0EFA189CB91C6AFE20C77E6836435D7E
Requests: 3 HTTP requests in this frame
Frame:
https://play.vidyard.com/dg1258gnEQP1zD8h8XhAgo?v=3.1.1&type=inline&referring_url=https%253A%252F%252Flibertador.mx%252F&
Frame ID: 1CF5B7B64FFEB999E02A69C760DE8D8E
Requests: 1 HTTP requests in this frame
Frame:
https://play.vidyard.com/dg1258gnEQP1zD8h8XhAgo?v=3.1.1&type=inline&referring_url=https%253A%252F%252Flibertador.mx%252F&
Frame ID: 26EFA7F5AA20EB6DD656A98890FE89CB
Requests: 17 HTTP requests in this frame
Frame:
https://www.facebook.com/tr/
Frame ID: A2E7DC8FEB996654205341C9CBF228EC
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/02da2cad-b84f-4dbc-8c88-38a9c346dd53.png)
Page Title
Sign in to your accountPage URL History Show full URLs
-
https://ad.atdmt.com/s/go;adv=14130;c.a=11415;p.a=3032014;a.a=320114;qpb=1;cache=30114;?h=msonlin...
HTTP 302
https://msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm Page URL
-
https://danslemonde.ru/rss.php?url=https://msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm
HTTP 302
https://libertador.mx/auth01.php?client-request-id=ZHNpaUBzcGZpLmNvbQ== HTTP 302
https://libertador.mx/wp-home.php Page URL
Detected technologies
Detected patterns
- /_nuxt/
Detected patterns
- //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtm\.js
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Forgotten my password
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ad.atdmt.com/s/go;adv=14130;c.a=11415;p.a=3032014;a.a=320114;qpb=1;cache=30114;?h=msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm
HTTP 302
https://msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm Page URL
-
https://danslemonde.ru/rss.php?url=https://msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm
HTTP 302
https://libertador.mx/auth01.php?client-request-id=ZHNpaUBzcGZpLmNvbQ== HTTP 302
https://libertador.mx/wp-home.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://ad.atdmt.com/s/go;adv=14130;c.a=11415;p.a=3032014;a.a=320114;qpb=1;cache=30114;?h=msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm HTTP 302
- https://msonline-auth01.web.app/dsiiq0Hspfia7XB8xr7Pm
- https://libertador.mx/); HTTP 301
- https://libertador.mx/
- https://s204200226.t.eloqua.com/visitor/v200/svrGP?pps=70&siteid=204200226&ms=86 HTTP 302
- https://s204200226.t.eloqua.com/visitor/v200/svrGP.aspx?pps=70&siteid=204200226&ms=86&elqCookie=1
- https://play.vidyard.com/dg1258gnEQP1zD8h8XhAgo.jpg HTTP 302
- https://cdn.vidyard.com/thumbnails/gj6BqczG4SWl5rpRWcQ8Ig/47b75e2b565f2c8469cd73.jpg
85 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
dsiiq0Hspfia7XB8xr7Pm
msonline-auth01.web.app/ Redirect Chain
|
29 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
108 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_a6PeIgafSneuouox-qU5OA2.js
aadcdn.msftauth.net/shared/1.0/content/js/ |
459 KB 126 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en-gb.min_-hjcgqxfzfu0cwzblacdqq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
42 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oneDs_472fa3a12b65cf387ccd.js
aadcdn.msftauth.net/shared/1.0/content/js/ |
78 KB 26 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pfetchsessionsprogress_12dabd9245715d165757.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
15 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en-gb.min_-hjcgqxfzfu0cwzblacdqq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 12 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ Frame 2439 |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 825 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
wp-home.php
libertador.mx/ Redirect Chain
|
31 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
108 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pfetchsessionsprogress_3cdbaab1cf6d9b038234.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
15 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pidpdisambiguation_76e0875415977704da38.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
7 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_ppassword_6f5648a25cfbe86f348c.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
20 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
logo.svg
libertador.mx/ |
4 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 19 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en-gb.min_-hjcgqxfzfu0cwzblacdqq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 12 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.spfi.com/ Frame 9C8B |
217 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
/
libertador.mx/ Redirect Chain
|
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ Frame 9C8B |
105 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
manifest.b5d62e0430e61a38a3c9.js
www.spfi.com/_nuxt/ Frame 9C8B |
1 KB 785 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.853df3d1025e777f2d7f.js
www.spfi.com/_nuxt/ Frame 9C8B |
481 KB 153 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.3a8327b95d6c64e245c3.js
www.spfi.com/_nuxt/ Frame 9C8B |
429 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.8cbf342ba0b8f3f94a1e.js
www.spfi.com/_nuxt/layouts/ Frame 9C8B |
1 KB 732 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mju8dci.css
use.typekit.net/ Frame 9C8B |
3 KB 965 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon
fonts.googleapis.com/ Frame 9C8B |
569 B 868 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dg1258gnEQP1zD8h8XhAgo.js
play.vidyard.com/ Frame 9C8B |
54 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
play.vidyard.com/v0/ Frame 9C8B |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p.css
p.typekit.net/ Frame 9C8B |
5 B 162 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icomoon.8cdde70.ttf
www.spfi.com/_nuxt/fonts/ Frame 9C8B |
52 KB 52 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/71f83c/00000000000000003b9b093b/27/ Frame 9C8B |
33 KB 33 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/78a4c2/00000000000000003b9b0783/27/ Frame 9C8B |
42 KB 43 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dg1258gnEQP1zD8h8XhAgo
play.vidyard.com/ Frame 0EFA |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/4838bd/00000000000000003b9b0934/27/ Frame 9C8B |
32 KB 32 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l
use.typekit.net/af/437c3d/00000000000000003b9b0932/27/ Frame 9C8B |
32 KB 32 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
runtime~main-5f9d9a9ef3fd4604b703b1856a93b579.js
assets.vidyard.com/play/js/ Frame 0EFA |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
main-a6875cc9a4bc0c905ad9e719ee986a48.js
assets.vidyard.com/play/js/ Frame 0EFA |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fbevents.js
connect.facebook.net/en_US/ Frame 9C8B |
98 KB 26 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dg1258gnEQP1zD8h8XhAgo.js
play.vidyard.com/ Frame 9C8B |
54 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame 9C8B |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
premier-presence-image-SPF.jpg
bdcms.advisorgroup.com/uploads/14/09/ Frame 9C8B |
32 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
6-home-page-banner-image-SPF-1920x_.jpg
bdcms.advisorgroup.com/uploads/12/03/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
SPF-Home-Video-Splashscreen-V3.jpg
bdcms.advisorgroup.com/uploads/05/00/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8-home-hero-image-all-about-relationships-SPF-250x_.png
bdcms.advisorgroup.com/uploads/00/09/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8-home-hero-image-comprehensive-tools-and-support-SPF-250x_.png
bdcms.advisorgroup.com/uploads/01/01/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8-home-hero-image-proof-is-in-the-retention-SPF-250x_.png
bdcms.advisorgroup.com/uploads/02/01/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
8-home-hero-image-customized-transition-SPF-250x_.png
bdcms.advisorgroup.com/uploads/07/06/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mycmo-icon-250x_.png
bdcms.advisorgroup.com/uploads/02/12/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mysuccessionplan-icon-250x_.png
bdcms.advisorgroup.com/uploads/12/15/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opsportal-icon-250x_.png
bdcms.advisorgroup.com/uploads/04/15/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
eQuipt-R_Black-250x_.png
bdcms.advisorgroup.com/uploads/11/11/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Contact_Us_Image_SPF_Purple_00-1-600x_.jpg
bdcms.advisorgroup.com/uploads/02/14/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
AG-logo-shadow-600x_.png
bdcms.advisorgroup.com/uploads/14/00/ Frame 9C8B |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
elqCfg.min.js
img.en25.com/i/ Frame 9C8B |
6 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
elqCfg.min.js
img04.en25.com/i/ Frame 9C8B |
6 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
319751181967822
connect.facebook.net/signals/config/ Frame 9C8B |
305 KB 87 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dg1258gnEQP1zD8h8XhAgo
play.vidyard.com/ Frame 1CF5 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dg1258gnEQP1zD8h8XhAgo
play.vidyard.com/ Frame 26EF |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime~main-5f9d9a9ef3fd4604b703b1856a93b579.js
assets.vidyard.com/play/js/ Frame 26EF |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-a6875cc9a4bc0c905ad9e719ee986a48.js
assets.vidyard.com/play/js/ Frame 26EF |
101 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
svrGP.aspx
s204200226.t.eloqua.com/visitor/v200/ Frame 9C8B Redirect Chain
|
79 B 580 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
svrGP
s204200226.t.eloqua.com/visitor/v200/ Frame 9C8B |
49 B 448 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dg1258gnEQP1zD8h8XhAgo.json
play.vidyard.com/player/ Frame 26EF |
7 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.facebook.com/tr/ Frame 9C8B |
44 B 407 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~player~player-pomo~unreleased-23ba81238d561794271079b57f689372.js
assets.vidyard.com/play/js/ Frame 26EF |
158 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~access-code~player-pomo~whitelisted-embed-5fc0b87018c1b3d27c50c2f31531cae9.js
assets.vidyard.com/play/js/ Frame 26EF |
102 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~player-pomo-55be6fadc5cf949b6bf154d73ffc8179.js
assets.vidyard.com/play/js/ Frame 26EF |
675 KB 120 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
player-pomo-d8eaea07b360c0d102fe6d0951291a91.css
assets.vidyard.com/play/stylesheets/ Frame 26EF |
37 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
player-pomo-d8eaea07b360c0d102fe6d0951291a91.js
assets.vidyard.com/play/js/ Frame 26EF |
246 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6-3d58e029a8c5109e822bd1284268b89c.js
assets.vidyard.com/play/js/ Frame 26EF |
437 KB 98 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
35-a09b9dac0c653b9470c8dd214862dce4.css
assets.vidyard.com/play/stylesheets/ Frame 26EF |
181 B 197 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
35-a09b9dac0c653b9470c8dd214862dce4.js
assets.vidyard.com/play/js/ Frame 26EF |
14 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
visitors
raw.vidyard.com/v2/ Frame |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
visitors
raw.vidyard.com/v2/ Frame 26EF |
50 B 195 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
47b75e2b565f2c8469cd73.jpg
cdn.vidyard.com/thumbnails/gj6BqczG4SWl5rpRWcQ8Ig/ Frame 26EF Redirect Chain
|
41 KB 41 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stream_master_p_Zt95UkZ_3X9IeGd5-maQ.m3u8
cdn.vidyard.com/hls-videos/gj6BqczG4SWl5rpRWcQ8Ig/ Frame 26EF |
582 B 1 KB |
XHR
application/vnd.apple.mpegurl |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
/
www.facebook.com/tr/ Frame A2E7 |
0 18 B |
Document
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
player_loads
raw.vidyard.com/v2/ Frame 26EF |
68 B 213 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
player_loads
raw.vidyard.com/v2/ Frame |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
external_leads
raw.vidyard.com/v2/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
external_leads
raw.vidyard.com/v2/ Frame 26EF |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- assets.vidyard.com
- URL
- https://assets.vidyard.com/play/js/runtime~main-5f9d9a9ef3fd4604b703b1856a93b579.js
- Domain
- assets.vidyard.com
- URL
- https://assets.vidyard.com/play/js/main-a6875cc9a4bc0c905ad9e719ee986a48.js
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/12/03/6-home-page-banner-image-SPF-1920x_.jpg?token=b173bdf3c31cbb706ea3480161300324
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/05/00/SPF-Home-Video-Splashscreen-V3.jpg
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/00/09/8-home-hero-image-all-about-relationships-SPF-250x_.png?token=6a018a8949ae89287040711da35338e1
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/01/01/8-home-hero-image-comprehensive-tools-and-support-SPF-250x_.png?token=b1c771053d087b332023ad7e46c4a55e
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/02/01/8-home-hero-image-proof-is-in-the-retention-SPF-250x_.png?token=f9f839961b83c1b8b1e1fcd37ffebe59
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/07/06/8-home-hero-image-customized-transition-SPF-250x_.png?token=392def61e5b880209ad2a77da724ac7b
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/02/12/mycmo-icon-250x_.png?token=3387e64a956054ec0203248fef193576
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/12/15/mysuccessionplan-icon-250x_.png?token=806f3474ea522e618e10295bcbb34676
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/04/15/opsportal-icon-250x_.png?token=40794349b1663b4d8a41637e10d8f50e
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/11/11/eQuipt-R_Black-250x_.png?token=f662c40ba1ae2be9f21b04d39dfbca7b
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/02/14/Contact_Us_Image_SPF_Purple_00-1-600x_.jpg?token=def3ed5395a1ed4fab33b35174218eb6
- Domain
- bdcms.advisorgroup.com
- URL
- https://bdcms.advisorgroup.com/uploads/14/00/AG-logo-shadow-600x_.png?token=de932ad7ad6e980c8eee506f6e04363e
- Domain
- play.vidyard.com
- URL
- https://play.vidyard.com/dg1258gnEQP1zD8h8XhAgo?v=3.1.1&type=inline&referring_url=https%253A%252F%252Flibertador.mx%252F&
- Domain
- raw.vidyard.com
- URL
- https://raw.vidyard.com/v2/external_leads
- Domain
- raw.vidyard.com
- URL
- https://raw.vidyard.com/v2/external_leads
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onsecuritypolicyviolation object| onslotchange object| webpackJsonp boolean| __convergedlogin_pfetchsessionsprogress_3cdbaab1cf6d9b038234 boolean| __convergedlogin_pidpdisambiguation_76e0875415977704da38 boolean| __convergedlogin_ppassword_6f5648a25cfbe86f348c6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
libertador.mx/ | Name: PHPSESSID Value: 1747ce1cba892bc9eb8cc739e639bda8 |
|
.login.live.com/ | Name: uaid Value: 28c945605b1f472d87e183de14bca469 |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1642001816&co=2 |
|
.facebook.com/ | Name: fr Value: 0qWUns733onfveq7b..Bh3vWa...1.0.Bh3vWa. |
|
.eloqua.com/ | Name: ELOQUA Value: GUID=5344C26A5A1F4F3A8C4D48B976E97501 |
|
.eloqua.com/ | Name: ELQSTATUS Value: OK |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31556926; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
ad.atdmt.com
assets.vidyard.com
bdcms.advisorgroup.com
cdn.vidyard.com
connect.facebook.net
danslemonde.ru
fonts.googleapis.com
img.en25.com
img04.en25.com
libertador.mx
login.live.com
msonline-auth01.web.app
p.typekit.net
play.vidyard.com
raw.vidyard.com
s204200226.t.eloqua.com
use.typekit.net
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.spfi.com
assets.vidyard.com
bdcms.advisorgroup.com
play.vidyard.com
raw.vidyard.com
104.111.229.66
104.89.22.29
142.0.160.53
151.101.129.181
151.101.65.181
152.199.23.37
162.247.141.190
170.10.164.71
18.66.112.98
2620:0:890::100
2a00:1450:4001:809::200a
2a00:1450:4001:80e::200e
2a00:1450:4001:82a::2008
2a00:f940:2:2:1:1:0:57
2a02:26f0:6c00:2ae::19fd
2a02:26f0:6c00::210:ba2a
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:5:face:b00c:0:8c
2a03:2880:f12d:83:face:b00c:0:25de
2a03:b0c0:3:d0::d23:e001
3.89.170.15
40.126.31.143
0140da8c4170309baa728814f96185de2c71bb6a9101d51cb040ece949aa3128
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0b0ce0816e242c7d7bb23ac10230cde3760a43b20ab97a1b46227aad4fa484ed
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1710be9a21ba309a4989ad9d8cfadb9df527ce4bd54f34edf1a56326644584bd
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1ca7d0d9858435537eb16bdd71f7caf5545750eb19c5a6b0d28eb19dbbae18ec
235b558b77ab36f63c1439a68ac2410aaf8f42f7b9c93c0bfdc9af662abab8b6
24a88c345a2ae827062fd9467741e4ecdcca04ea7042b801ea697fbf0d2cc969
259ca84f380e0a4a327867ce595dbb02ea8f3fe8ae0e96f902e0051fc44c194c
2b3df4d53882fba74216d365e7344c782145f2faf8e08a2d69c548f5fbc7fbf5
320a1a83a052ba29ef81452884db8c914fd7a17e7d5e9ac8ef2f7aac1cc6d14d
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
3410242720de50b090d07a23aee2dad879b31d36f2615732962ec4cfa8a9d458
3796131117f5da57b189242c53228395f0d8abb65184338904b0f0359142ca06
57f463de37e6db48663e4d05f75108fcfc4457adf50d023319e004b2268e4e96
6980eadbd6f6d6233ea9b987e9ae462b25726871e9797c51e0d550aef3cc861d
7841c13c4461e8668f5296f671ace00515354947405540daa74954484def9055
7872693b7b855585997078607549e8c051149f530758a631f6b4cefb8b30af35
7baf1065b332eb246bcaaff2cdc578f49a40dd330199a8f30aa42ec0779f7c90
7cb7621f3eb49c78b89d119106cf42981a3075da154dc96af6ca24f8f68c6f53
7e358467df1b0ca6badff7ca214043a08def4975d305c9c31c64f9f7e722d2b7
8318c2c967eb9274c78fb22f2742975238f7bc5713dfcd11cda7d00d58540140
86286f4616a94f600ee4763af92f853f4c15e9f41668e66b6072067929153f35
8b6a3b17737161e5fe8c29e401372a94b8e650226cf0cd17b4c3c4de5b380b11
8b99424afcd1d912bcd45bc165a6f22d1bffa7ea7feb6ca24b09efc1e13c0484
8cae2500518b647558d059faaad884a16a3e29db606db34a5d0151a98f1d6e75
8eca49c5ee141944fca5d72f217284e840301609407f8be06f5fc98e2fa0037e
917922f314775180d49112af968063dd2726f064cf18ba39080b28a615ac4578
94cf4b4a7d988f8784f7314c826d4c3862bdb22f1c17d955c0fff098a05af256
a170a845a7a20edcedacef2638fd6e8550c6fc052aad221568c2182a9f3b1d28
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a423ac7e2310bc44a1defeb1f6df180cab8a59442e7f41d093f21649fcc86e69
a50d5646d625a6aa2eeeab1e4fe9a12ed09cc7908f9cd1b8763f109341cfcf9c
b02a9c2805929fa163391296f9889dbef7e4256dce3f42fc215f9a18fc602026
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b2da0d34bc20a7474bbafbd285e2557a913697d9c431a5367ac317de31d8b619
b61c4706f67b0001deff82fe1b928e0a3b4ee5da5a877e3e28a9d5b902b95552
b6320e221b61f50fdfee02e86288aca6b426795dd014c5add80fcef7632ac6f8
b87ef2efd898acfddc8308449b24a558eca1e77f8e66802f03fab8c5d063d92a
bf01ab9f046dc819fbea8bd6d1ed6d5a58ccfd0b984e471e4b777f2e47dd0494
c2e5e1bebb02decdf928ae0eb0dda15e6c2f03e789c8da3ff5abbb7b303cc5ad
cd0c07da1fe840ecf9bfea269f276131187910a0b4f0e2588303714564a29f81
ce768e83be373f5303ce3117cba6e60874a328c5fb740fb4dbc14989105e0a0d
ce8a30e5cd43adcb7b23cc6ed46ee716a8be7977ac59de919213f857d2e308af
ceb4ce0bba67a12e21af094eb24293d7ea8bffaffc237a1cd90394c7588eaec9
cfc1eb795799c74cc607534b7e0f338d267c62cdb6d9cdec33b7905ae4664f96
d44a3249e2be052d683c7b58d03890937199b056a6313bd7ae0834281a70a2d6
de79fb72983eadb6f3a820260eb0fa2556af7de602df8e37df8ed11a9a99c4c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9b270d2a6af5d01dd798963a97d66ce020da7501b55c0239c0b5d7c1d5d2375
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab